php - str_replace / addslashes() / htmlspecialchars() .... for quote and double quote
477
I have a problem.
If I complete my form with " or ' in my form the program bug
I want replace " and ' by code like ' " ' " or addslash or whatever...
Help me please
My code :
if (isset($_POST['key'])){
mysql_select_db($database_dbprotect, $dbprotect);
$key = mysql_real_escape_string($_POST['key']);
$verif_query = sprintf("SELECT * FROM $bloc_news_entreprise WHERE $bloc_news_entreprise.key='$key'");
$verif = mysql_query($verif_query, $dbprotect) or die(mysql_error());
$row_verif = mysql_fetch_assoc($verif);
$utilisateur = mysql_num_rows($verif);
if ($utilisateur) {
echo '<span>Cette key existe déjà</span>';}
else {
$key = $_POST['key'];
$tpl = $_POST['tpl'];
$urlA = $_POST['urlA'];
$urlB = $_POST['urlB'];
$urlC = $_POST['urlC'];
$urlD = $_POST['urlD'];
$descriptif = $_POST['descriptif'];
$bigTitre = $_POST['bigTitre'];
$titreA = $_POST['titreA'];
$titreB = $_POST['titreB'];
$titreC = $_POST['titreC'];
$titreD = $_POST['titreD'];
$add_bloc = sprintf("INSERT INTO $bloc_news_entreprise ($bloc_news_entreprise.key, tpl, urlA, urlB, urlC, urlD, descriptif, bigTitre, titreA, titreB, titreC, titreD) VALUES ('$key', '$tpl', '$urlA','$urlB','$urlC','$urlD', '$descriptif', '$bigTitre', '$titreA', '$titreB', '$titreC', '$titreD')");
mysql_select_db($database_dbprotect, $dbprotect);
$result = mysql_query($add_bloc, $dbprotect) or die ("Impossible d'ajouter les données utilisateur dans la base de donnée");
header("Location:config-bloc.php?addbloc=ok");
exit;
}
}
Answer
Solution:
You can convert to
htmlentitiesbefore passing to database insert query as follows:When you will execute select query, convert data fetched back to single/double inverted commas by using following:
Answer
Solution:
First of all mysql function are deprecated you should use pdo_mysql. Then for quote you can use htmlspecialchars or htmlentities or addslashes but don't forget to use the reverse function when you read it.